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POPE QBFUSr.ATION AND CONTROLLING 
a PROCESSOR BY EMULATION 

The Dresent invention relates to a method of producing obfuscated 
object code, an executable program in object code, a method of producing 
storage media having a secured executable program thereon, and a storage 
media having a secured executable program thereon. The present invention 
also relates to a method of controlling a processor to run a program. 

In general, this invention relates to software security. It is well known 
that software can be valuable, and that there are persons and organisations 
who seek to circumvent any security measures applied to protect the software. 

Programs are written in high level languages such as C and Fortran. 
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15 They are then compiled into object code, which may be machine language or- • 
may be transformed into machine language. Devices, such as compilers, are- 
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available to make the translation of a source code into an object code. The- — - 
machine language is a stream of binary digits which will include the instruct.oris - - 
for an executable program but may also include various security means, for • • 
example, to ensure that only genuine copies of programs can be run. Crackers 
seek to obtain clear code so that they can circumvent any security means and 
they are helped in this as, for example, reverse compilers which will produce 
source code from a binary stream are available. 

It has been suggested to pad the object code, that is, to add redundant 
additional code, to hide or obfuscate the functional object code but crackers 
have proved adept at recognising and removing the padding. It has also been 
suggested that the object code be encrypted. However, an encryption key 
needs to be available when the program is run so that the instructions can be 
decrypted. It will be apparent that once a cracker finds the key, access to the 
unencrypted code is provided. 

The present invention seeks to provide new and improved methods of 
securing software. 



35 



According to a first aspect of the present invention there is provided a 



WO 2005/020068 



2 



PCT/GB2004/003560 



^f. ,er=,tpH nhiect code, the method comprising the steps 
me .hod of producing selected funct i=n of the variable, 



operations. 



As variables are compiled into series of operations, the size of the object 
AS vanaoie e (he useftl| code 

.code they need. 

. . variabte is presented comprises oomplementa-y operatons arranged, upon^ 
• inning of the object code, to provide the vanable. 

Z0T in this respect the length of the object code is greatly increased and the 
objec.»*rZbyobfusolted,b y presen fi n g avariab.e.forexa mp ,e,asa 

series of arithmetic or other operations. 

25 ,„ an embodiment, the selected function is defined in a template of the 

source code. 

For example, the template of the source code defines a plurality of 
functions vlich are each arranged to compile to present the variable a a 
30 set "otrafiona, and the method further comprises selecting one of the 
functions to substitute for the variable in the source code. 

Preferably a different key is associated with each one of the functions in 
me temS and the method further comprises substituting the vanable m 
„ 1 ce cot with the template and selecting one of the functions ,n the 
3 em £X ^selecting fhe key which is associated with said one function. 
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The provision of a plurality of functions which may each be selected to 
substitute for the variable enables a particular variable to be comp.led ,n a 
number of different ways. This is particularly helpful" where one source hs 
producing many different software applications. For example, a manufacturer 
of C Ds will produce CDs with differenttit.es and contents but will keep formats 
and security measures common across all titles. In many prior - art secunty 
solutions, a cracker only needs to crack the protection on one title to be 
enabled to crack all titles by replicating the actions made. 

The provision of a plurality of functions, as defined above enables a 
different function to be chosen for the same variable for each different tfe The 
rackers" endeavours to access the contents of one CD ti t e, he^ore are not 
assisted if the cracker does manage to access the contents of 
,n addition, the useofakey method toselectthe functions enables some- . , 
automation of the process of securing the software. ~ 

^ ' in an embodiment, the source code involves stored arrays and 
templates and utilises pointers to navigate the arrays and templates. 

Preferably, the source code is a standard programming language. For 
example, the source code is C ++ . 

The present invention also extends to an executable program in object 
code, the program having been compiled from source code where, a enable 
in the source code has been compiled to be presented ,n object code as a 
series of operations whereby the object code is obfuscated. 

The series of operations by which the variable is presented may be 
j made up of arithmetic and/or logical operations, and the series of "P**" 
Tinged upon running of the object code, to provide the vanable Add,honally 

d rlrna,ive,y, the series of operations by which the variable « presente 
ma y comprise complementary operations arranged, upon runmng of the object 
code, to provide the variable. 
5 The use of a series of operations which are arranged, upon running of 



- PCT/GB2004/003560 
WO 2005/020068 4 

operations. 

10 F or exa^e, the seiected funcfion was defined in a .annate of the 

source code. 

„s ^ we, each * „ 5UbsUlul 
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for the variable in the source code. 

^.a^aspacto, ^ — 
meth od of producing storage med* « ^ ^ fe program 
thereon, the method oompns,ng the wnicn h 

by as so«ng .he -^^1 • - * the 
arra nged to control aooess to W xecrf* e p ^ ^ 

secured execute program to * e *>^ e ^ ^ program , wherein the 
comprising obfuscating the object code ofthe secur V P g # 

obi eC code of the -«"^ 0 ^ S f ^ varia b,e. and compiiing 
varieble in source code with a ^selected I tortono ^ 

panted is made up o, arithmetic and/or ^ ^ ^ „ pr0 , |de the 
e„es o, operations is arranged, upo« o, ob ec ^ ^ 

variable. Additionaii, and/or arrang ed, upon 
variable is presented compnses P 
5 running of the object code, to prov,de the vanabie. 



WO 2005/020068 



5 



PCT/GB2004/003560 



Preferably, the executable program and the security program are 
associated at object code level. 

The security orogram which is provided to control access to the 
5 executable program may be any suitable security program. For example the 
security program may be arranged to encrypt the executable program, and/or 
blocks of the executable program may be moved into the security program, 
and/or the security program may be arranged to require the running of an 
authentication program. 

10 

In an embodiment, the selected function in the source code of the 
security program is defined in a template of the source code. 

For example, said template of the security program source code defines 
15 a plurality of functions which are arranged to compile to present the vanable as 
a series of operations, and the method further comprises selecting one of the 
functions to substitute for the variable in the source code. 

Preferably a different key is associated with each one of the functions in 
20 the template, and the method further comprises substituting the variable in 
source code with the template and selecting one of the functions in the 
template by selecting the key which is associated with said one function. 

In an embodiment, the source code of the security program involves 
25 stored arrays and templates and utilises pointers to navigate the arrays and 
templates. 

The source code of the security program is preferably a standard 
programming language such as C**. 

30 

Preferably, the storage media onto which the secured executable 
program is applied is an optical disc and, for example, the secured executable 
program is applied onto the optical disc by laser beam encoding. 

35 Alternatively, the storage media onto which the secured executable 

program is applied is memory in, or associated with, servers, computers and/or 
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other processing means. For example, the storage media may be a hard diso 
in, or connected to, a computer. 

The present invention also extends to a storage media having a secured 
i executable program thereon, wherein an executable program is secured by 
a* a JJ* program associated therewith, the security 
arranged to control access to the executable program, and wherein the seounty 
program is in object code which has been obfascated. the seounty program 
Tg been compiled from source code, and a variable in ft. 
o the security program having been compiled to be presented ,n object code as a 
series of operations whereby the object code has been obfuscated. 

For example, the series of operations by which the variable is presented 
is made up of arithmeUc and/or logical operations, and wherein the senes of . 
5 Orations is arranged, upon running of the object code, to prov.de £ n*-* . 
Additionally and/or alternatively, the series of operations by which the vanable 
t presented comprises compfcrnentary operator* arranged, upon runntng of 
the object code, to provide the variable. 

20 in an embodiment, the series of operations has been produced by 

' subsmutingmevariableinftesourcecodeofthesecurityprogramw^a 

selected function arranged to cause the variable to be presented ,n the 
compiled object code as a series of operations. 

25 For example, the selected function was defined in a template of the 

source code. 

In an embodiment, the template of the source code had defined a 
plurality of functions which were each arranged to compile to present the 
30 variable as a series of operations, and one of the functicns had been selected 
to substitute for the variable in the source code. 

Preferably, the executable program and the security program are 
associated at object code level. 
35 The executable program may be encrypted on the storage media and 
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the associated security program is then arranged to enable decryption of the 
executable program. 

Additionally and/or alternatively, blocks from the executable program 
5 may have been relocated within the security program. 

Additionally and/or alternatively, the security program may be arranged 
to require the running of an authentication program. 
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Where the security program is arranged, for example, to requ.re the 
running of an authentication program, that authentication program will also be 
provided on the storage media. It would be possible for the security program to 
incorporate the authentication program, but currently it is generally preferred 
that the security program points to the authentication program. 

In an embodiment, the storage media is an optical disc on which the 
executable program and the security program are encoded. For example, the 
optical disc is a CD, a CD-ROM, or a DVD. 

In an alternative embodiment, the storage media is memory in, or 
associated with, servers, computers and/or other processing means and on 
which the executable program and the security program are stored. For 
example, the storage media may be a hard disc in, or connected to, a 
computer. 

The executable program is a games program, and/or a video program, 
and/or an audio program, and/or other software. 

In this latter respect it will be appreciated that the securing methods 
defined above are generally applicable to all software applications. The 
executable programs provided on the storage media may compr.se games 
programs and/or video programs, and/or audio programs and/or any other 
multi-media formats. 

A method of producing obfuscated object code, and/or an executable 
program in object code, and/or a method of producing storage media having a 
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secured executable program thereon, and/or a storage media having a secured 
executable program thereon as defined above may each be used alone or in 
conjunction with a method of controlling a processor to run a program, and/or a 
storage media having a secured executable program thereon as defined below. 

According to a still further aspect of the present invention there is 
provided a method of controlling a processor to run a program comprising the 
steps of translating instructions from the program into a reduced instructs set 
format to which said processor is not responsive, 

causing the translated instructions to be applied to a virtual processor 
which is responsive to the reduced instruction set format, and 

causing the virtual processor to run the instructions applied thereto and 
to apply a series of simple instructions, to which the processor is response, to 
the processor. 

Generally, the instructions from a program which are applied to a 
processor, such as a CPU, are clear and it is possible for crackers to access 
the instructions during running of the program to get access to the program 
With a method of the invention, the translated instructions applied to a v.rtual 
processor, that is a processor configured in software, are not the standard 
instructions generally used and therefore are not useful to the cracker. 
Furthermore, the series of simple instructions which are applied to the 
processor are greater in number than would be usual and thus obfuscate the 
instructions. 

In a preferred embodiment, the method further comprises encrypting the 
translated instructions to be applied to the virtual processor, and enabl.ng the 
virtual processor to respond to the encrypted instructions without decryptmg 
them. 

One weakness of encryption techniques is that a key or other device has 
to be provided to enable decryption. Crackers have experience of .dent.fy.ng 
such a key However, methods of the invention do not require the v.rtual 
processor to decrypt the translated instructions in order to run the instructs 
so that no key is provided. Decryption can be avoided by providing .n the 
virtual processor information enabling the virtual processor to understand each 
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might be accessed by crackers. 

It is also proposed that more than one series of instructions in the 

from those received by other virtual processors. This can be a 
10 use of templates. 

Thus in a preferred embodiment, the method further comprises utilising 

1 5 instruction from the program. 

20 the translation for said instruction. 

:S=5£k=s====- 

with the selected key. 
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As exptained previous*, the use of keys enables some automaton of 
30 the programming required to perform the method. 

lt w ,„ be appreciated that the use of '™^£Z» of 
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processing by the virtual processor. 

A method of controlling a processor as defined above may be used 
alone or may be used in conjunction with a method of producing obfuscated 
object code, and/or an executable program in object code, and/or a method of 
producing storage media having a secured executable program thereon, and/or 
a storage media having a secured executable program thereon as defined 
above. 

The present invention also extends to a storage media having a secured 
executable program thereon, wherein an executabte program 
having a security program and an emulation program assorted herewith, the 
se" my program being arranged to control access to the executable program^ 
and the emulation program causing predetermined funcbonsor routines he 
executable program to be run on a virtual processor provided by sa,d emulahon 
pXam. wberel the emulahon program is arranged to translate tnstruotons 
from the executable program into a reduced instruct set forma , to cause me 
translated instructions to be applied to the virtual processor, and to cause the 
virtual processor to run the instructions applied thereto and to output a senes of 
20 simple instructions for application to a processor. 

Embodiments of the present invention will hereinafter be described, by 
way of example, with reference to the accompanying drawings, in wh,ch: 

Figure 1 shows schematically the translation of a h,gh level source code 
into machine language and illustrates the use of templates by a compter; 

Figure 2 schematically illustrates the production of an ophcal d,sc w,th a 
secured executable program; and 

Figure 3 illustrates the use of a virtual processor in a method of 
controlling a processor of the invention. 

Fmbodiments of the present invention are described below and 
illustrated, with reference to executable programs such as games programs 
which are provided on optica, discs such as CD-ROMs or DVDs. However ,t 
will be appreciated that the present invention is not restricted to the particular 
examples given and in particular is applicable to all software and to any storage 
media for storing the software. 
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For example, the present invention may be used with software which is 
stored on memory in, or associated with, personal computers and/or servers 
and/or other processing means and/or with software arranged to be 
5 downloaded to computers. It is noted particularly that the present invent™ can 
be used in conjunction with digital rights management software. 

Figure 1 shows the translation of source code, indicated at 2, into a 
machine language, that is a sequence of binary digits, indicated at 4 As » 
10 shown, the source code 2 which is generally a high level language, for 
example, C, C". or Fortran, is translated into object code 6 by way of a 
compiler 8. 

In some instances, depending upon the language of the source code 2 
15 and the nature of the compiler 8, the object code 6 is the same or substantially 
similar to the machine language 4. In the embodiment illustrated m Figure 1 . 
the object code 6 is translated by an assembler 10 to provide the machine 
language 4. 

20 The method illustrated in Figure 1 is applicable irrespective of the type of 

the source code 2, but it is described and illustrated further with particular 
reference to C" source code 2. C" is a particularly flexible language as it 
uses, as indicated in Figure 1 , templates and arrays generally indicated at 12 
14 and 16. The template 14 of Figure 1 has been indicated as CValue and his 

25 is a class template which is to be used in the present invention to obfuscate the 
object code 6 produced from the source code 2. 

To give a very simple example, a program written in C might set the 
values of variables, such as int i and int j as set out below: 

30 

int i = 5 
intj = i + 6 

As can be seen in Figure 1 . the template CValue provides for each of 
35 keys ko ki -to k n an associated function of a variable, namely functions f(.nto), 
fCintO .'..f(int n) . Eachofthesefunctionsisdifferentandeachinvo.ves,for 



WO 2005/020068 



12 



PCT/GB2004/003560 



example, a series of arithmetic or logical operations. 

When using the illustrated method, a programmer replaces the values of 
variables in the source code with specified functions from the CValue template 
5 14 Thus instead of int i = 5 the source code will specify CValue < key, int > i - 

5 Accordingly, during compilation of the source code 2 to form the object code 

6 the variable int i which was to be set to 5 will be replaced by the ser.es of 
operations defined by the appropriate function f(int 0 ), f(inti) .... f(int n ) as 
determined from the CValue template 14 by selecting one of the keys k 0) ki ... 

io k n . 

As set out above, variables in the source code have been replaced by, 
for example, a series of mathematical operations. This causes obscurity in or 
obfuscation of the resulting object code 6. Thus, instead of setting int . to 5, for 
15 example, f(into) might specify the following sequence of operations: 

m = 5 + key 
n = 6 + key 
p = m + n 
20 l = p-(2xkey) 

intl = i. 

In this manner, the variable i has been set to 5 but in a series of 
operations. In the object code 6 output by the compiler 8 all of the operations 
25 indicated will appear to be useful so that a cracker will have difficulty in 
comprehending where the obfuscation arises. Of course, as the operations 
lead eventually to the correct value for the required variable, the object code 6, 
or the machine language 4 assembled therefrom can be directly run by a 
processor without the need for any decryption or decoding. 

30 

The operations carried out on the variables in this manner will generally 
be much more complex than those set out above. In addition, rather than using 
a series of simple arithmetic operators such as plus, divide, subtract and 
multiply, it will generally be preferred to use functions such as XOR which can 
35 reliably return a variable to its assigned value. In this respect, a technique 
which may be used in practice is set out below. 
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This technique uses C ++ templates to implement V where: 
q = T_M ANG LE_SEED_VALU E_N XOR T_MANGLE_SEED_VALUE_M 

5 template<class T, int x = 0, int z = 0> 
struct V 
{ 

T operator ()(Tx,Tv,Tz) 
{ 

10 Ty = x A z; 

return (T) (v A y); 

} 

T operator ( ) (T v) 
{ 

15 Ty = x A z; 

return (T) (v A y ); 

} 

}; 

int main (int argc, char* argv [ ] ) 

20 { 

int z = T_MANGLE_SEED_VALUE_M;. 
int y = T_MANGLE_SEED_VALUE_N; 
if (12345678 == argc) 
{ 

25 / / This never happens 

z = T_MANGLE_SEED_VALUE_0; 
y = T_MANGLE_SEED_VALUE_P; 

} 

int a = V<int, T_MANGLE_SEED_VALU E_N , T_MANGLE_SEED_VALU E_M> 

30 O (argc); 

// Here a == V 
int b = a; 

return = V<int> ( ) (y, b, z); 

} 

35 

Looking at the generated code, we see q's components (N and M) are 
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used to mangle the value, and then q is used at run time to unmangle the 
value. This is asymmetric, in that no single value is used in the encrypt/decrypt 
cycle. 

5 It will be apparent from the above that the method causes variables in 

the source code to be presented in the object code as a series of operations. 
This adds complexity and obscurity to the object code and provides protection 
against crackers. 

10 In addition, the provision of different functions which can be selected by 

selection of an associated key enables different object codes to be generated 
to perform the same function. Thus, one title of a game can be provided in the 
same format as a second title. However, each title can have different object 
code. Therefore, if a cracker manages to crack the code of the first title this will 

1 5 not provide assistance for the cracking of the second title. 

Figure 2 shows schematically a method of applying a secured game to a 
CD-ROM 30. In this respect, and as indicated above, the invention is only 
exemplified by reference to a games program stored on an optical disc. The 

20 invention can be used to secure any software which is stored on any media. 
Thus, for example, the invention may be used to secure executable programs 
stored on memory in, or associated with, servers, computers, and/or other 
processing means. The invention is particularly useful where it is wished to 
download the executable programs, for example, using rights management 

25 software to ensure that only authorised users have access to the secured 
executable programs and/or to control the degree or manner of the access to 
the secured executable programs by users. 

In the embodiment illustrated in Figure 2, the game comprises a game 
30 program game.exe 20 and this is to be applied to the CD-ROM 30 with 

appropriate security software. In this respect, a software toolkit 22 provides the 
programs necessary to protect the game program 20. The toolkit 22 includes a 
security applying program SECPREP.DLL 24 which acts to access an 
appropriate security program 28 which is to be wrapped with the games 
35 program 20. In this respect, the security applying program 24 accesses one of 
a number of security programs SECSERV.DLL 28 which are appropriately 
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stored in memory 26. Each individual security program 28 is associated with a 
respective key 32 and the security applying program 24 randomly chooses one 
the keys 32 whereby the corresponding security program 28 is selected. 
Thereafter, the selected security program 28 is packaged with the games 
program 20 and with any other security measures to form an executable 
program file 34 which is then stored, that is, in this example, applied to the CD- 
ROM 30 by appropriate encoding means (not shown). 

In the embodiment illustrated in Figure 2 the toolkit 22 has not only 
packaged the games program 20 with the security program 28, but it has also 
provided an authentication program 36. 

The security program 28 acts as a wrapper for the games program 20 
and the authentication program 36. Thus, when the executable application file 

15 34 is accessed by a user putting the CD-ROM 30 into a drive in a computer, the 
security program 28 requires the authentication program 36 to run. For 
example, and in known manner, the authentication program 36 may look for 
known errors on the disc 30. which errors will have been put on the disc 30 
during the production process described above. The disc will be declared 

20 genuine if the expected errors are found and in that case the security program 
28 will then enable the loading and running of the game program 20. In this 
respect, whenever the security program 28 is running the object code it 
produces will be obfuscated as described above, making it difficult for crackers 
to identify and remove the security program 28. This prevents the crackers 

2 5 from gaining access to the games program 20. 

The security offered by the security program 28 can be improved by, for 
example, taking blocks of programming, for example, as indicated at 38, from 
the games program and incorporating them in the security program 28. 
Pointers 40 to the blocks 38 are provided in the games program 20. By this 
technique parts of the game program itself are also hidden from crackers by the 
obfuscated code which is produced when running the blocks 38 within the 
security program 28. The movement of blocks 38 from the games program 20 
and into the security program 28 is undertaken by the software toolkit 22 during 
3 5 the production of the executable program file 34. 



30 



WO 2005/020068 



16 



PCT/GB2004/003560 



It will be appreciated that security measures additional to those 
described and illustrated in Figure 2 may be incorporated by way of the 
software toolkit 22. For example, the games program 20 may also be 
encrypted. 

5 The techniques described above for obfuscation of code may be used 

alone to secure software or may be used in conjunction with the following 
emulation technique. The emulation technique which will now be described 
and illustrated with reference to Figure 3, may be used in conjunction with other 

10 security techniques or it may be used alone. 

It will be appreciated that a program, for example, in C 4 * language, is 
compiled to produce an instruction set for application to a processor. If a 
cracker can get clear access to the instruction set, for example, of a game, 
15 reverse engineering of the game can be carried out. Figure 3 illustrates an 
emulation technique which can be used to hide instructions from crackers. 

As indicated in Figure 3, source code 2 is applied to a compiler 50 to 
produce an instruction set indicated at 52. However, the compiler 50 is • 
20 arranged to encrypt the compiled instructions and is also arranged to proy.de 
instructions in a reduced instruction set format rather than the more usual 
native instructions. 

As illustrated in Figure 3, the compiler 50 is provided with a library 54 of 
25 templates 58 which, as described above with reference to Figure 1 . can 
selectively provide one of a number of instruction sets at 52. In this respect, 
the compiler 50 is arranged to select one of a number of keys 56 whereby a 
corresponding template 58 is selected for use in the production of the 
instruction set 52. A virtual processor or emulator 60 is also configured in 
30 software using the selected key by way of an emulator compiler 64. This 
enables the emulator 60 to act on the instructions in the instructs set 52 
without needing to decrypt them. 

By way of example, the instruction set obtained by the use of the 
35 template 58 with the key 0 might be encrypted by the addition of the value +3 to 
each variable value. The emulator 60, therefore, can understand that each 
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variable must be .educed by three and can therefore exec e .he s r ebons. 
Thus, for example, I the MOV instruction should be 0 and the emptor 
receives the variable 3 it can understand that, for this mstruchon set, 3 . to be 
rr M OV and act accordingly. By this means, .before, .here is no clear and 
unencrypted instruction set input to the emulator 60. 

In addition, the emulatorSO is arranged to produce a large series of 
instructions for each genuine instruction and to apply 
instructions to a CPU 62. For example, instead of mstrucbng the CPU 62 to 
add 3 the emulator 60 might issue the string of instructions: 

add 10, 

subtract 7, 

divide by 1, 

This adTs to the' comptexity of the instructions being fed to the CPU 62 and mis 
complexity also acts to obfuscate the code for crackers. 

it will be appreciated that using the emulator 60 as described will add to 
the real *me required for processing and it is not, therefore, approbate to run 
, a games program on CPU 62 in this manner. Instead, parts only of the 
JZZ are to be hidden from crackers using this technique. For^xampje ,t 
SZue is used in function with the techniques descnbed above>e 
securi* program 28, which may include blocks 38 from the games program 20, 
can be subject to the emulation technique. 

5 It will be appreciated from the above that if during compilation a different 

Key 56 is chosen the instruction set 52 will be changed as will the emulator 60. 
™s ability to use different instruction sets and emulators on «£* 
adds a further level of security as it enables different dscs publrshed by the 

0 ^manufacturertohaved^ferentsecurity. 

instruction set 52 remains encrypted as this ensures that there ,s no 
instruction set available which might be used by crackers. 

It will be appreciated that alterations and modifications may be made to 
,5 toe invent as described and illustrated within the scope of the appended 
claims. 



